Malicious @velora-dex/sdk 9.4.1 Uses Import-Time Payload to Install macOS Backdoor

Apr 7, 2026 · Original article ↗

Summary

StepSecurity analyzed malicious @velora-dex/sdk 9.4.1, which runs on import and contacts a C2 server. Its macOS payload drops an architecture-specific binary and registers launchctl persistence; the article provides investigation findings and recovery steps.

Key points

Published on April 7, 2026, version 9.4.1 had malicious code prepended to dist/index.js and no corresponding source-repository commit.
Importing the package triggers a shell command that downloads a script from http://89.36.224.5/troubleshoot/mac/install.sh; the payload does not rely on an install hook.
In a controlled GitHub Actions run, StepSecurity’s Harden-Runner recorded the C2 connection and process chain. The Linux runner skipped the macOS binary download.
On macOS, the script downloads an architecture-specific binary into ~/Library/Application Support/com.apple.Terminal/profiler and registers it with launchctl as zsh.profiler.
The article recommends pinning to version 9.4.0 or earlier, removing the binary and persistence entry if present, rotating accessible credentials, and reviewing network logs for the C2 IP.

Article Details

Attack Vectors: A malicious @velora-dex/sdk version 9.4.1 was published directly to npm without a corresponding source-repository commit; malicious code was prepended to dist/index.js.
The injected code runs when the package is imported, spawns a shell, and downloads an install script from the reported C2 server.
The install script downloads an architecture-specific macOS binary and uses launchctl to register it as a persistent service.
The binary is placed at ~/Library/Application Support/com.apple.Terminal/profiler, a path and filename described in the article as masquerading as legitimate.
Defensive Notes: If @velora-dex/[email protected] was installed or imported, treat the machine and accessible secrets as compromised; pin to version 9.4.0 or earlier and rotate credentials.
On affected macOS machines, remove the zsh.profiler launchctl service and the dropped profiler binary.
Review firewall, proxy, and CI/CD network logs for connections to 89.36.224.5; the article says such a connection indicates the package contacted the C2 server.
Search package lockfiles, npm caches, developer machines, and CI/CD baselines for the compromised version and C2 indicators.

Indicators of compromise

Type	Indicator	Context
IPV4	`89[.]36[.]224[.]5`	Reported C2 server contacted by the malicious package to retrieve the install script and macOS payloads.
URL	`hxxp[:]//89[.]36[.]224[.]5/mac/arm/driver/profiler`	Reported URL serving the malicious ARM64 macOS binary.
URL	`hxxp[:]//89[.]36[.]224[.]5/mac/intel/driver/profiler`	Reported URL serving the malicious Intel macOS binary.
URL	`hxxp[:]//89[.]36[.]224[.]5/troubleshoot/mac/install.sh`	Malicious install script URL fetched by the package's import-time payload.